Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

When an app asks for permissions, it should have a “feed fake data” option

mastodon.gamedev.place

Post reply on HN
Print view View original

301–310 of 413 posts

Re: When an app asks for permissions, it should have a “feed fake data” option

#301

Post by crazygringo »

lldb wrote: post #161
ryandrake wrote: post #27

I’m all for the “fake data” idea, but also: Apps should be required to gracefully handle the cases where users deny permission to access real data. I know last time I developed for iOS, it was Apple’s policy that apps cannot punish users or exit() the app in retaliation for them denying a permission. Apps must gracefully handle it and continue running. Also, and this was even longer ago, apps could not require users…

Worst offender is google photos on iOS - you can’t even open the app without giving it all photos access. Selected photos doesn’t count. Even just to view photos already saved in the cloud.

That's incorrect, I just tried it on iOS.

When you open it, it defaults to the "Photos" tab which has a message (not a dialog) asking for all photos access. But if you switch to any other tab (like Search or Library) you've got access to all of your photos in the cloud.

On the one hand you wouldn't realize that if you never tried tapping another tab. But on the other hand, the main "Photos" tab is designed to access all of your local photos and show whether or not they're backed up. Most (although not all) people are probably using Google Photos for this (to save local photos to the cloud), so it at least makes some sense for it to be the main tab with a prominent request.

Re: When an app asks for permissions, it should have a “feed fake data” option

#303

Post by matthewfcarlson »

floomk wrote: post #211
ryandrake wrote: post #90

Earlier quoted context omitted.

Good question! We actually asked Apple exactly this when appealing the AppStore de-listing. How come others can require an account and we can't? What was it about our app that made us have to spend the engineering effort to add a guest login (this was a disingenuous argument that I advised against, since we deliberately spent engineering effort to require the login)? Their response, not the exact wording since it was…

> We're reviewing your app, not theirs, so what they can do is irrelevant rules for thee but not for me Apple has never been fair with its review, sadly. > I would expect Apple's response to be "change it back". Companies should not have to bend over to apple's whims just to get their software in end user hands. Hopefully upcoming EU regulation will reign apple's overreach in a bit.

If you were protesting a speeding ticket, I suspect the defense of “the guy next to me was going even faster” wouldn’t go very well.

Re: When an app asks for permissions, it should have a “feed fake data” option

#304

Post by NoRelToEmber »

charcircuit wrote: post #26
progbits wrote: post #3

XPrivacy for rooted android could do this 7+ years ago and there are other modern alternatives (but I haven't rooted my phone for a long time so I can't vouch for them): https://github.com/M66B/XPrivacy Obviously that is not mainstream, I agree it should come built in. But then both Android and iOS allow bullshit like region-locked apps or preventing screenshots from DRM content, so good luck with that.

>region-locked apps There is no such thing. The respective app stores allow you to distribute apps in select regions. This is an important feature for app stores because an app may not be a good experience in all countries. The app may not be localized to all languages, there may not be content moderators for those languages, those countries have a multitude of laws that you need to comply with, your app may include…

Your answer amounts to "Yes, both those things exist to the detriment of the user, but they were requested for the benefit of corporate app writers, so it's okay that the device the user supposedly owns obeys someone else."

Re: When an app asks for permissions, it should have a “feed fake data” option

#305

Post by kerkeslager »

charcircuit wrote: post #276
aftbit wrote: post #34

Earlier quoted context omitted.

>This is a feature requested app developers due to the legal requirements when licensing content such as movies. Movie studios don't want people streaming or recording their movies so app platforms need a way to surely show this content. Of course, but if our industry had any chutzpah, we would have simply said "no, that's impossible" and continued to distribute operating systems where the user has ultimate control o…

>no, that's impossible When you are a platform owner it is important that you evaluate the needs of all stakeholders and not just the needs of the users of the platforms. Telling app developers that you are not willing to compromise is not a great way to convince them to create apps for your platform. Also as a platform you want your platform to appear as a safe place for content owners to have their content on. You…

> When you are a platform owner it is important that you evaluate the needs of all stakeholders and not just the needs of the users of the platforms.

I disagree. The literal entire purpose of every single non-user entity involved in this situation is to serve users, and if it's not serving users, then that's a systemic failure. If corporations want a place at the table, they should be serving users, and if they can't serve users, there should not be a table for them to sit at, period.

In the cases referenced, that means DRM should be illegal, period. Platforms shouldn't have to allow DRM to attract content creators, because there should not be competitors that have DRM. If the option to have DRM doesn't exist, then platforms don't have to compete to attract content creators with user-hostile misfeatures like DRM.

Our economy should be designed to serve people, not corporations. Anything else is a failure.

I understand the law says corporations are people. I'm saying the law is wrong.

Re: When an app asks for permissions, it should have a “feed fake data” option

#306

Post by atorodius »

ciex wrote: post #262
JimDabell wrote: post #242

Earlier quoted context omitted.

> on iOS, you cannot distinguish if you were granted a permission or not. This isn’t correct. For instance, accessing location services provides CLAuthorizationStatus: https://developer.apple.com/documentation/corelocation/claut... …and push notifications have UNAuthorizationStatus: https://developer.apple.com/documentation/usernotifications/... …and health data has HKAuthorizationStatus: https://developer.apple.com/…

I recently tried using Sony's (frustrating) Imaging Edge app to transfer photos from a camera to an iPad and gave it limited access and it refused to transfer images! When I changed the permissions to full access it worked. So there must be some difference, maybe not an obvious one.

Not sure how they do that, but I’d say that on most iPhones in the wild, having the API return <25 images is probably a pretty good indicator that that’s not all pictures.

Re: When an app asks for permissions, it should have a “feed fake data” option

#308

Post by lilyball »

jadbox wrote: post #68
mormegil wrote: post #45

Earlier quoted context omitted.

> apps could not require users to have “an account” in order to run There is some big qualification missing or I don't understand what does that even mean. How could a banking app run without an account? An online game? The Twitter app nowadays? Dropbox/Nextcloud/...? Etc. Yeah, I agree that for a lot of apps, requiring a account is just a marketing gimmick, but I don't think such a general rule could work.

There are many exceptions to the rule with Apple's policies. I knew a few app developers that could skirt many of the official rules, because they had friends that worked for Apple.

They’re lying to you then, because “friends that work for Apple” have no say in the App review process.

Re: When an app asks for permissions, it should have a “feed fake data” option

#309

Post by zzo38computer »

I think that "feed fake data" is the wrong way to do it. The good way should be something like "feed data from alternate source", where the alternate source can be any other program. This other source could be anything that the user wants to put in by that other programs, such as: empty data, random data, fake but consistent data, data from an alternate file (e.g. a separate contacts list, or a picture from a file instead of from the camera), transformed in some way (e.g. turning a picture from a camera upside-down), filtered, logged, or asking the user every time for each individual piece of data, feeding error codes instead of data (and allowing the user to specify which error codes), etc. (This should include everything even the current date/time access.)

This is useful for better user control and for purposes of testing and accessibility purposes.

(My own idea of operating system design, one of the ideas involved (there are many other ideas, but most of them are not relevant here) is the "proxy capabilities", with capability-based security including proxy capabilities; all I/O uses it, and it can also be used in a better way than the UNIX pipes (using the command shell), and in other ways. This also includes even the date/time. No system calls other than Yield and Quit can be used without being given a capability key.

Re: When an app asks for permissions, it should have a “feed fake data” option

#310

Post by curt15 »

alickz wrote: post #300
ryandrake wrote: post #27

I’m all for the “fake data” idea, but also: Apps should be required to gracefully handle the cases where users deny permission to access real data. I know last time I developed for iOS, it was Apple’s policy that apps cannot punish users or exit() the app in retaliation for them denying a permission. Apps must gracefully handle it and continue running. Also, and this was even longer ago, apps could not require users…

> it was Apple’s policy that apps cannot punish users or exit() the app in retaliation for them denying a permission It's been the same since runtime permissions on Android, which was like Marshmallow i believe https://developer.android.com/training/permissions/requestin...

Policy is one thing, but enforcement is what really matters. Do Google Play reviewers actually reject apps that hold core functionality hostage?
Post reply on HN